Skip to content

Commit 26cb01b

Browse files
nmarukovichhors
nmarukovich
and
hors
authored
K8SPSMDB-1418 fix ca (#2265)
* K8SPSMDB-1418 fix ca * fix PR comments * add test to run * fix PR comments --------- Co-authored-by: Viacheslav Sarzhan <slava.sarzhan@percona.com>
1 parent cd04a13 commit 26cb01b

22 files changed

Lines changed: 912 additions & 9 deletions

File tree

‎build/physical-restore-ps-entry.sh‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,11 @@ trap 'handle_sigterm' 15
2525

2626
touch /opt/percona/restore-in-progress
2727

28+
if [ -d /etc/s3/certs-in ] && [ -n "$(ls -A /etc/s3/certs-in/*.crt 2>/dev/null)" ]; then
29+
cat /etc/s3/certs-in/*.crt > /etc/s3/certs/ca-bundle.crt
30+
chmod 0644 /etc/s3/certs/ca-bundle.crt
31+
fi
32+
2833
if [[ -z ${PBM_AGENT_TLS_ENABLED} ]] || [[ ${PBM_AGENT_TLS_ENABLED} == "true" ]]; then
2934
MONGO_SSL_DIR=/etc/mongodb-ssl
3035
if [[ -e "${MONGO_SSL_DIR}/tls.crt" ]] && [[ -e "${MONGO_SSL_DIR}/tls.key" ]]; then

‎e2e-tests/demand-backup-logical-minio-native-tls/compare/find.json‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
switched to db myApp
2+
{ "_id" : , "x" : 100500 }
3+
bye

‎e2e-tests/demand-backup-logical-minio-native-tls/compare/statefulset_some-name-rs0-oc.yml‎

Lines changed: 293 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,293 @@
1+
apiVersion: apps/v1
2+
kind: StatefulSet
3+
metadata:
4+
annotations: {}
5+
generation: 1
6+
labels:
7+
app.kubernetes.io/component: mongod
8+
app.kubernetes.io/instance: some-name
9+
app.kubernetes.io/managed-by: percona-server-mongodb-operator
10+
app.kubernetes.io/name: percona-server-mongodb
11+
app.kubernetes.io/part-of: percona-server-mongodb
12+
app.kubernetes.io/replset: rs0
13+
name: some-name-rs0
14+
ownerReferences:
15+
- controller: true
16+
kind: PerconaServerMongoDB
17+
name: some-name
18+
spec:
19+
podManagementPolicy: OrderedReady
20+
replicas: 3
21+
revisionHistoryLimit: 10
22+
selector:
23+
matchLabels:
24+
app.kubernetes.io/component: mongod
25+
app.kubernetes.io/instance: some-name
26+
app.kubernetes.io/managed-by: percona-server-mongodb-operator
27+
app.kubernetes.io/name: percona-server-mongodb
28+
app.kubernetes.io/part-of: percona-server-mongodb
29+
app.kubernetes.io/replset: rs0
30+
serviceName: some-name-rs0
31+
template:
32+
metadata:
33+
annotations: {}
34+
labels:
35+
app.kubernetes.io/component: mongod
36+
app.kubernetes.io/instance: some-name
37+
app.kubernetes.io/managed-by: percona-server-mongodb-operator
38+
app.kubernetes.io/name: percona-server-mongodb
39+
app.kubernetes.io/part-of: percona-server-mongodb
40+
app.kubernetes.io/replset: rs0
41+
spec:
42+
containers:
43+
- args:
44+
- --bind_ip_all
45+
- --auth
46+
- --dbpath=/data/db
47+
- --port=27017
48+
- --replSet=rs0
49+
- --storageEngine=wiredTiger
50+
- --relaxPermChecks
51+
- --sslAllowInvalidCertificates
52+
- --clusterAuthMode=x509
53+
- --tlsMode=requireTLS
54+
- --enableEncryption
55+
- --encryptionKeyFile=/etc/mongodb-encryption/encryption-key
56+
- --wiredTigerCacheSizeGB=0.25
57+
- --wiredTigerIndexPrefixCompression=true
58+
- --config=/etc/mongodb-config/mongod.conf
59+
- --quiet
60+
command:
61+
- /opt/percona/ps-entry.sh
62+
env:
63+
- name: SERVICE_NAME
64+
value: some-name
65+
- name: MONGODB_PORT
66+
value: "27017"
67+
- name: MONGODB_REPLSET
68+
value: rs0
69+
envFrom:
70+
- secretRef:
71+
name: internal-some-name-users
72+
optional: false
73+
imagePullPolicy: Always
74+
livenessProbe:
75+
exec:
76+
command:
77+
- /opt/percona/mongodb-healthcheck
78+
- k8s
79+
- liveness
80+
- --ssl
81+
- --sslInsecure
82+
- --sslCAFile
83+
- /etc/mongodb-ssl/ca.crt
84+
- --sslPEMKeyFile
85+
- /tmp/tls.pem
86+
- --startupDelaySeconds
87+
- "7200"
88+
failureThreshold: 4
89+
initialDelaySeconds: 60
90+
periodSeconds: 30
91+
successThreshold: 1
92+
timeoutSeconds: 10
93+
name: mongod
94+
ports:
95+
- containerPort: 27017
96+
name: mongodb
97+
protocol: TCP
98+
readinessProbe:
99+
exec:
100+
command:
101+
- /opt/percona/mongodb-healthcheck
102+
- k8s
103+
- readiness
104+
- --component
105+
- mongod
106+
- --ssl
107+
- --sslInsecure
108+
- --sslCAFile
109+
- /etc/mongodb-ssl/ca.crt
110+
- --sslPEMKeyFile
111+
- /tmp/tls.pem
112+
failureThreshold: 8
113+
initialDelaySeconds: 10
114+
periodSeconds: 3
115+
successThreshold: 1
116+
timeoutSeconds: 2
117+
resources:
118+
limits:
119+
cpu: 500m
120+
memory: 1G
121+
requests:
122+
cpu: 100m
123+
memory: 100M
124+
securityContext:
125+
runAsNonRoot: true
126+
terminationMessagePath: /dev/termination-log
127+
terminationMessagePolicy: File
128+
volumeMounts:
129+
- mountPath: /data/db
130+
name: mongod-data
131+
- mountPath: /etc/mongodb-secrets
132+
name: some-name-mongodb-keyfile
133+
readOnly: true
134+
- mountPath: /etc/mongodb-ssl
135+
name: ssl
136+
readOnly: true
137+
- mountPath: /etc/mongodb-ssl-internal
138+
name: ssl-internal
139+
readOnly: true
140+
- mountPath: /etc/mongodb-config
141+
name: config
142+
- mountPath: /opt/percona
143+
name: bin
144+
- mountPath: /.mongodb
145+
name: mongosh
146+
- mountPath: /etc/mongodb-encryption
147+
name: some-name-mongodb-encryption-key
148+
readOnly: true
149+
- mountPath: /etc/users-secret
150+
name: users-secret-file
151+
workingDir: /data/db
152+
- args:
153+
- pbm-agent-entrypoint
154+
command:
155+
- /opt/percona/pbm-entry.sh
156+
env:
157+
- name: PBM_AGENT_MONGODB_USERNAME
158+
valueFrom:
159+
secretKeyRef:
160+
key: MONGODB_BACKUP_USER_ESCAPED
161+
name: internal-some-name-users
162+
optional: false
163+
- name: PBM_AGENT_MONGODB_PASSWORD
164+
valueFrom:
165+
secretKeyRef:
166+
key: MONGODB_BACKUP_PASSWORD_ESCAPED
167+
name: internal-some-name-users
168+
optional: false
169+
- name: PBM_MONGODB_REPLSET
170+
value: rs0
171+
- name: PBM_MONGODB_PORT
172+
value: "27017"
173+
- name: PBM_AGENT_SIDECAR
174+
value: "true"
175+
- name: PBM_AGENT_SIDECAR_SLEEP
176+
value: "5"
177+
- name: POD_NAME
178+
valueFrom:
179+
fieldRef:
180+
apiVersion: v1
181+
fieldPath: metadata.name
182+
- name: PBM_MONGODB_URI
183+
value: mongodb://$(PBM_AGENT_MONGODB_USERNAME):$(PBM_AGENT_MONGODB_PASSWORD)@localhost:$(PBM_MONGODB_PORT)/?tls=true&tlsCertificateKeyFile=/tmp/tls.pem&tlsCAFile=/etc/mongodb-ssl/ca.crt&tlsInsecure=true
184+
- name: PBM_AGENT_TLS_ENABLED
185+
value: "true"
186+
- name: SSL_CERT_FILE
187+
value: /etc/s3/certs/ca-bundle.crt
188+
imagePullPolicy: Always
189+
name: backup-agent
190+
resources: {}
191+
securityContext:
192+
runAsNonRoot: true
193+
terminationMessagePath: /dev/termination-log
194+
terminationMessagePolicy: File
195+
volumeMounts:
196+
- mountPath: /etc/mongodb-ssl
197+
name: ssl
198+
readOnly: true
199+
- mountPath: /opt/percona
200+
name: bin
201+
readOnly: true
202+
- mountPath: /data/db
203+
name: mongod-data
204+
- mountPath: /etc/s3/certs-in
205+
name: ca-bundle-in
206+
readOnly: true
207+
- mountPath: /etc/s3/certs
208+
name: ca-bundle
209+
dnsPolicy: ClusterFirst
210+
initContainers:
211+
- command:
212+
- /init-entrypoint.sh
213+
imagePullPolicy: Always
214+
name: mongo-init
215+
resources:
216+
limits:
217+
cpu: 500m
218+
memory: 1G
219+
requests:
220+
cpu: 100m
221+
memory: 100M
222+
terminationMessagePath: /dev/termination-log
223+
terminationMessagePolicy: File
224+
volumeMounts:
225+
- mountPath: /data/db
226+
name: mongod-data
227+
- mountPath: /opt/percona
228+
name: bin
229+
restartPolicy: Always
230+
schedulerName: default-scheduler
231+
securityContext:
232+
fsGroup: 1001
233+
serviceAccount: default
234+
serviceAccountName: default
235+
terminationGracePeriodSeconds: 60
236+
volumes:
237+
- name: some-name-mongodb-keyfile
238+
secret:
239+
defaultMode: 288
240+
optional: false
241+
secretName: some-name-mongodb-keyfile
242+
- emptyDir: {}
243+
name: bin
244+
- emptyDir: {}
245+
name: mongosh
246+
- configMap:
247+
defaultMode: 420
248+
name: some-name-rs0-mongod
249+
optional: true
250+
name: config
251+
- name: some-name-mongodb-encryption-key
252+
secret:
253+
defaultMode: 288
254+
optional: false
255+
secretName: some-name-mongodb-encryption-key
256+
- name: ssl
257+
secret:
258+
defaultMode: 288
259+
optional: false
260+
secretName: some-name-ssl
261+
- name: ssl-internal
262+
secret:
263+
defaultMode: 288
264+
optional: true
265+
secretName: some-name-ssl-internal
266+
- name: users-secret-file
267+
secret:
268+
defaultMode: 420
269+
secretName: internal-some-name-users
270+
- name: ca-bundle-in
271+
projected:
272+
defaultMode: 420
273+
sources:
274+
- secret:
275+
items:
276+
- key: ca.crt
277+
path: ca-0.crt
278+
name: minio-ca-bundle
279+
- emptyDir: {}
280+
name: ca-bundle
281+
updateStrategy:
282+
type: OnDelete
283+
volumeClaimTemplates:
284+
- metadata:
285+
name: mongod-data
286+
spec:
287+
accessModes:
288+
- ReadWriteOnce
289+
resources:
290+
requests:
291+
storage: 3Gi
292+
status:
293+
phase: Pending

0 commit comments

Comments
 (0)